private/sdk_sandbox.te

###
### SDK Sandbox process.
###
### This file defines the security policy for the sdk sandbox processes.

type sdk_sandbox, domain;

typeattribute sdk_sandbox coredomain;

net_domain(sdk_sandbox)
app_domain(sdk_sandbox)

# TODO(b/252967582): remove this rule if it generates too much logs traffic.
auditallow sdk_sandbox {
    property_type
    # remove expected properties to reduce noise.
    -servicemanager_prop
    -hwservicemanager_prop
    -use_memfd_prop
    -binder_cache_system_server_prop
    -graphics_config_prop
    -persist_wm_debug_prop
    -aaudio_config_prop
    -adbd_config_prop
    -apex_ready_prop
    -apexd_select_prop
    -arm64_memtag_prop
    -audio_prop
    -binder_cache_bluetooth_server_prop
    -binder_cache_telephony_server_prop
    -bluetooth_config_prop
    -boot_status_prop
    -bootloader_prop
    -bq_config_prop
    -build_odm_prop
    -build_prop
    -build_vendor_prop
    -camera2_extensions_prop
    -camera_calibration_prop
    -camera_config_prop
    -camerax_extensions_prop
    -codec2_config_prop
    -config_prop
    -cppreopt_prop
    -dalvik_config_prop
    -dalvik_prop
    -dalvik_runtime_prop
    -dck_prop
    -debug_prop
    -debuggerd_prop
    -default_prop
    -device_config_memory_safety_native_prop
    -device_config_nnapi_native_prop
    -device_config_runtime_native_boot_prop
    -device_config_runtime_native_prop
    -dhcp_prop
    -dumpstate_prop
    -exported3_system_prop
    -exported_config_prop
    -exported_default_prop
    -exported_dumpstate_prop
    -exported_pm_prop
    -exported_system_prop
    -ffs_config_prop
    -fingerprint_prop
    -framework_status_prop
    -gwp_asan_prop
    -hal_instrumentation_prop
    -hdmi_config_prop
    -heapprofd_prop
    -hw_timeout_multiplier_prop
    -init_service_status_private_prop
    -init_service_status_prop
    -libc_debug_prop
    -lmkd_config_prop
    -locale_prop
    -localization_prop
    -log_file_logger_prop
    -log_prop
    -log_tag_prop
    -logd_prop
    -media_config_prop
    -media_variant_prop
    -mediadrm_config_prop
    -module_sdkextensions_prop
    -net_radio_prop
    -nfc_prop
    -nnapi_ext_deny_product_prop
    -ota_prop
    -packagemanager_config_prop
    -pan_result_prop
    -permissive_mte_prop
    -persist_debug_prop
    -pm_prop
    -powerctl_prop
    -property_service_version_prop
    -radio_control_prop
    -radio_prop
    -restorecon_prop
    -rollback_test_prop
    -sendbug_config_prop
    -setupwizard_prop
    -shell_prop
    -soc_prop
    -socket_hook_prop
    -sqlite_log_prop
    -storagemanager_config_prop
    -surfaceflinger_color_prop
    -surfaceflinger_prop
    -system_prop
    -system_user_mode_emulation_prop
    -systemsound_config_prop
    -telephony_config_prop
    -telephony_status_prop
    -test_harness_prop
    -timezone_prop
    -usb_config_prop
    -usb_control_prop
    -usb_prop
    -userdebug_or_eng_prop
    -userspace_reboot_config_prop
    -userspace_reboot_exported_prop
    -userspace_reboot_log_prop
    -userspace_reboot_test_prop
    -vendor_socket_hook_prop
    -vndk_prop
    -vold_config_prop
    -vold_prop
    -vold_status_prop
    -vts_config_prop
    -vts_status_prop
    -wifi_log_prop
    -zygote_config_prop
    -zygote_wrap_prop
    -init_service_status_prop
}:file { getattr open read map };

# Allow finding services. This is different from ephemeral_app policy.
# Adding services manually to the allowlist is preferred hence app_api_service is not used.

allow sdk_sandbox activity_service:service_manager find;
allow sdk_sandbox activity_task_service:service_manager find;
allow sdk_sandbox appops_service:service_manager find;
allow sdk_sandbox audio_service:service_manager find;
allow sdk_sandbox audioserver_service:service_manager find;
allow sdk_sandbox batteryproperties_service:service_manager find;
allow sdk_sandbox batterystats_service:service_manager find;
allow sdk_sandbox connectivity_service:service_manager find;
allow sdk_sandbox connmetrics_service:service_manager find;
allow sdk_sandbox deviceidle_service:service_manager find;
allow sdk_sandbox display_service:service_manager find;
allow sdk_sandbox dropbox_service:service_manager find;
allow sdk_sandbox font_service:service_manager find;
allow sdk_sandbox game_service:service_manager find;
allow sdk_sandbox gpu_service:service_manager find;
allow sdk_sandbox graphicsstats_service:service_manager find;
allow sdk_sandbox hardware_properties_service:service_manager find;
allow sdk_sandbox hint_service:service_manager find;
allow sdk_sandbox imms_service:service_manager find;
allow sdk_sandbox input_method_service:service_manager find;
allow sdk_sandbox input_service:service_manager find;
allow sdk_sandbox IProxyService_service:service_manager find;
allow sdk_sandbox ipsec_service:service_manager find;
allow sdk_sandbox launcherapps_service:service_manager find;
allow sdk_sandbox legacy_permission_service:service_manager find;
allow sdk_sandbox light_service:service_manager find;
allow sdk_sandbox locale_service:service_manager find;
allow sdk_sandbox media_communication_service:service_manager find;
allow sdk_sandbox mediaextractor_service:service_manager find;
allow sdk_sandbox mediametrics_service:service_manager find;
allow sdk_sandbox media_projection_service:service_manager find;
allow sdk_sandbox media_router_service:service_manager find;
allow sdk_sandbox mediaserver_service:service_manager find;
allow sdk_sandbox media_session_service:service_manager find;
allow sdk_sandbox memtrackproxy_service:service_manager find;
allow sdk_sandbox midi_service:service_manager find;
allow sdk_sandbox netpolicy_service:service_manager find;
allow sdk_sandbox netstats_service:service_manager find;
allow sdk_sandbox network_management_service:service_manager find;
allow sdk_sandbox notification_service:service_manager find;
allow sdk_sandbox package_service:service_manager find;
allow sdk_sandbox permission_checker_service:service_manager find;
allow sdk_sandbox permission_service:service_manager find;
allow sdk_sandbox permissionmgr_service:service_manager find;
allow sdk_sandbox platform_compat_service:service_manager find;
allow sdk_sandbox power_service:service_manager find;
allow sdk_sandbox procstats_service:service_manager find;
allow sdk_sandbox registry_service:service_manager find;
allow sdk_sandbox restrictions_service:service_manager find;
allow sdk_sandbox rttmanager_service:service_manager find;
allow sdk_sandbox search_service:service_manager find;
allow sdk_sandbox selection_toolbar_service:service_manager find;
allow sdk_sandbox sensor_privacy_service:service_manager find;
allow sdk_sandbox sensorservice_service:service_manager find;
allow sdk_sandbox servicediscovery_service:service_manager find;
allow sdk_sandbox settings_service:service_manager find;
allow sdk_sandbox speech_recognition_service:service_manager find;
allow sdk_sandbox statusbar_service:service_manager find;
allow sdk_sandbox storagestats_service:service_manager find;
allow sdk_sandbox surfaceflinger_service:service_manager find;
allow sdk_sandbox telecom_service:service_manager find;
allow sdk_sandbox tethering_service:service_manager find;
allow sdk_sandbox textclassification_service:service_manager find;
allow sdk_sandbox textservices_service:service_manager find;
allow sdk_sandbox texttospeech_service:service_manager find;
allow sdk_sandbox thermal_service:service_manager find;
allow sdk_sandbox translation_service:service_manager find;
allow sdk_sandbox tv_iapp_service:service_manager find;
allow sdk_sandbox tv_input_service:service_manager find;
allow sdk_sandbox uimode_service:service_manager find;
allow sdk_sandbox vcn_management_service:service_manager find;
allow sdk_sandbox webviewupdate_service:service_manager find;

allow sdk_sandbox system_linker_exec:file execute_no_trans;

# Write app-specific trace data to the Perfetto traced damon. This requires
# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
perfetto_producer(sdk_sandbox)

# Allow profiling if the app opts in by being marked profileable/debuggable.
can_profile_heap(sdk_sandbox)
can_profile_perf(sdk_sandbox)

# allow sdk sandbox to use UDP sockets provided by the system server but not
# modify them other than to connect
allow sdk_sandbox system_server:udp_socket {
        connect getattr read recvfrom sendto write getopt setopt };

# allow sandbox to search in sdk system server directory
# additionally, for webview to work, getattr has been permitted
allow sdk_sandbox sdk_sandbox_system_data_file:dir { getattr search };
# allow sandbox to create files and dirs in sdk data directory
allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms;
allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms;

###
### neverallow rules
###

neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans };

# Receive or send uevent messages.
neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *;

# Receive or send generic netlink messages
neverallow sdk_sandbox domain:netlink_socket *;

# Too much leaky information in debugfs. It's a security
# best practice to ensure these files aren't readable.
neverallow sdk_sandbox debugfs:file read;

# execute gpu_device
neverallow sdk_sandbox gpu_device:chr_file execute;

# access files in /sys with the default sysfs label
neverallow sdk_sandbox sysfs:file *;

# Avoid reads from generically labeled /proc files
# Create a more specific label if needed
neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms };

# Directly access external storage
neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create};
neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search;

# Avoid reads to proc_net, it contains too much device wide information about
# ongoing connections.
neverallow sdk_sandbox proc_net:file no_rw_file_perms;

# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file
neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms;
neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms;

# SDK sandbox processes don't  have any access to external storage
neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms;
neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms;

neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms;

neverallow sdk_sandbox hal_drm_service:service_manager find;

# Only certain system components should have access to sdk_sandbox_system_data_file
# sdk_sandbox only needs search. Restricted in follow up neverallow rule.
neverallow {
    domain
    -init
    -installd
    -system_server
    -vold_prepare_subdirs
} sdk_sandbox_system_data_file:dir { relabelfrom };

neverallow {
    domain
    -init
    -installd
    -sdk_sandbox
    -system_server
    -vold_prepare_subdirs
    -zygote
} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto };

# sdk_sandbox only needs to traverse through the sdk_sandbox_system_data_file
neverallow sdk_sandbox sdk_sandbox_system_data_file:dir ~{ getattr search };

# Only dirs should be created at sdk_sandbox_system_data_file level
neverallow { domain -init } sdk_sandbox_system_data_file:file *;